Public API
Reviewed
🔌
Talk to the platform directly.
The fortrabbit public API is a REST interface to manage apps, environments, deployments and domains. It authenticates with a personal API token and is the foundation for the CLI.
Use cases
- Building an integration, a bot, or a custom dashboard
- A capability is missing from the CLI and the MCP server
- A credential is needed that does not expire or require a browser
API reference docs
The full endpoint reference is generated from the API itself and lives at:
Entry point
All endpoints sit under a single base URL:
https://api.fortrabbit.com/v1
Send Accept: application/json on every request. Without it the API answers in JSON-LD, which carries extra @-prefixed metadata most clients do not expect.
Authentication
The API authenticates with a personal API token. A token acts as the person who created it and sees what that person sees in the dashboard. Tokens are managed in the dashboard, under API tokens in the account menu. Pass the token as a bearer token on every request:
curl https://api.fortrabbit.com/v1/apps \
-H "Authorization: Bearer frbit-at-YOUR-TOKEN" \
-H "Accept: application/json"
Create a token
The token is created in the dashboard in two steps:
- A name to recognize it later
- The token itself you should copy
The full token is shown once, on the final step of that flow, and cannot be retrieved later. Copy it before leaving the page. A lost token cannot be recovered — delete it and create a new one.
List and delete tokens
Tokens for the account are listed in the dashboard, with name, a preview of the last characters and the date it was created.
Tokens do not expire. Delete the ones that are no longer in use — Delete next to a token in that listing, then confirm. Deleting takes effect immediately: requests carrying that token are rejected from then on, while every other token of the account keeps working.
API coverage
| Resource | Path |
|---|---|
| Apps | /v1/apps |
| Environments | /v1/environments |
| Deployments | /v1/deployments, /v1/environments/{id}/deployments |
| Domains | /v1/domains |
| Teams | /v1/teams |
| People | /v1/people |
| Payment methods | /v1/payment-methods |
Objects are addressed by their public ID — the same short ap-, en-, do- identifiers the dashboard shows. Collections accept a repeated publicId[] parameter to fetch several known objects in one call.
Rate limits
Requests are counted per token in a sliding window of one minute, currently at around 20 per minute. Every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset; a rejected request answers 429 and adds Retry-After with the seconds to wait. Failed authentications are counted separately, per IP address. Retrying a rejected credential in a loop locks the address out rather than the token.
Stability
The API is like the whole platform in BETA. Breaking changes are possible (but not likely) while that lasts, so pin nothing that cannot be adjusted. The /v1 prefix marks the shape of the API.